[media] cpia2_usb: don't use stack for DMA

The USB control messages require DMA to work. We cannot pass
a stack-allocated buffer, as it is not warranted that the
stack would be into a DMA enabled area.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
index 13620cdf05996fd3d549a5668043db0b12b1d381..e9100a23583104d3f6fcdcb4f0dfa9535877704a 100644 (file)
--- a/drivers/media/usb/cpia2/cpia2_usb.c
+++ b/drivers/media/usb/cpia2/cpia2_usb.c
@@ -545,18 +545,30 @@ static void free_sbufs(struct camera_data *cam)
 static int write_packet(struct usb_device *udev,
                        u8 request, u8 * registers, u16 start, size_t size)
 {
+       unsigned char *buf;
+       int ret;
+
        if (!registers || size <= 0)
                return -EINVAL;
 
-       return usb_control_msg(udev,
+       buf = kmalloc(size, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+
+       memcpy(buf, registers, size);
+
+       ret = usb_control_msg(udev,
                               usb_sndctrlpipe(udev, 0),
                               request,
                               USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                               start,   /* value */
                               0,       /* index */
-                              registers,       /* buffer */
+                              buf,     /* buffer */
                               size,
                               HZ);
+
+       kfree(buf);
+       return ret;
 }
 
 /****************************************************************************
@@ -567,18 +579,32 @@ static int write_packet(struct usb_device *udev,
 static int read_packet(struct usb_device *udev,
                       u8 request, u8 * registers, u16 start, size_t size)
 {
+       unsigned char *buf;
+       int ret;
+
        if (!registers || size <= 0)
                return -EINVAL;
 
-       return usb_control_msg(udev,
+       buf = kmalloc(size, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+
+       ret = usb_control_msg(udev,
                               usb_rcvctrlpipe(udev, 0),
                               request,
                               USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_DEVICE,
                               start,   /* value */
                               0,       /* index */
-                              registers,       /* buffer */
+                              buf,     /* buffer */
                               size,
                               HZ);
+
+       if (ret >= 0)
+               memcpy(registers, buf, size);
+
+       kfree(buf);
+
+       return ret;
 }
 
 /******************************************************************************